@mandujs/mcp 0.38.6 → 0.38.8

package/src/tools/spec.ts

@@ -1,11 +1,11 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import {
-  loadManifest,
-  generateManifest,
-} from "@mandujs/core";
-import { getProjectPaths } from "../utils/project.js";
-import path from "path";
-import fs from "fs/promises";
+import {
+  loadManifest,
+  generateManifest,
+} from "@mandujs/core";
+import { getProjectPaths, isInsideProject } from "../utils/project.js";
+import path from "path";
+import fs from "fs/promises";
 
 export const specToolDefinitions: Tool[] = [
   {
@@ -151,26 +151,42 @@ export function specTools(projectRoot: string) {
         kind: "api" | "page";
         withSlot?: boolean;
         withContract?: boolean;
-      };
-
-      const createdFiles: string[] = [];
-
-      // Scaffold app/ file
-      const fileName = kind === "api" ? "route.ts" : "page.tsx";
-      const appFilePath = path.join(paths.appDir, routePath, fileName);
-      const appFileDir = path.dirname(appFilePath);
-
-      await fs.mkdir(appFileDir, { recursive: true });
+      };
+
+      const createdFiles: string[] = [];
+      const normalizedRoutePath = normalizeRoutePath(routePath);
+      if (!normalizedRoutePath) {
+        return {
+          error: "Route path must be a non-empty relative path inside app/",
+        };
+      }
+
+      // Scaffold app/ file
+      const fileName = kind === "api" ? "route.ts" : "page.tsx";
+      const appFilePath = path.resolve(paths.appDir, normalizedRoutePath, fileName);
+      if (!isInsideProject(appFilePath, paths.appDir)) {
+        return {
+          error: "Route path resolves outside app/",
+        };
+      }
+      if (await Bun.file(appFilePath).exists()) {
+        return {
+          error: `Route source already exists: app/${normalizedRoutePath}/${fileName}`,
+        };
+      }
+      const appFileDir = path.dirname(appFilePath);
+
+      await fs.mkdir(appFileDir, { recursive: true });
 
       if (kind === "api") {
         await Bun.write(appFilePath, `export function GET(req: Request) {\n  return Response.json({ message: "Hello" });\n}\n`);
-      } else {
-        await Bun.write(appFilePath, `export default function Page() {\n  return <div>Page</div>;\n}\n`);
-      }
-      createdFiles.push(`app/${routePath}/${fileName}`);
-
-      // Derive route ID from path
-      const routeId = routePath.replace(/\//g, "-").replace(/[\[\]\.]/g, "");
+      } else {
+        await Bun.write(appFilePath, `export default function Page() {\n  return <div>Page</div>;\n}\n`);
+      }
+      createdFiles.push(`app/${normalizedRoutePath}/${fileName}`);
+
+      // Derive route ID from path
+      const routeId = normalizedRoutePath.replace(/\//g, "-").replace(/[\[\]\.]/g, "");
 
       // Scaffold slot if requested
       if (withSlot) {
@@ -265,6 +281,22 @@ export function specTools(projectRoot: string) {
   handlers["mandu_add_route"] = handlers["mandu.route.add"];
   handlers["mandu_delete_route"] = handlers["mandu.route.delete"];
   handlers["mandu_validate_manifest"] = handlers["mandu.manifest.validate"];
-
-  return handlers;
-}
+
+  return handlers;
+}
+
+function normalizeRoutePath(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim().replace(/\\/g, "/");
+  const withoutAppPrefix = trimmed.replace(/^app\//, "");
+  const normalized = withoutAppPrefix.replace(/^\/+|\/+$/g, "");
+  if (!normalized) return null;
+
+  const segments = normalized.split("/").filter(Boolean);
+  if (segments.length === 0) return null;
+  if (segments.some((segment) => segment === "." || segment === ".." || segment.includes(":") || segment.includes("\0"))) {
+    return null;
+  }
+
+  return segments.join("/");
+}

package/src/tools/transaction.ts

@@ -5,8 +5,8 @@ import {
   rollbackChange,
   getTransactionStatus,
   hasActiveTransaction,
-} from "@mandujs/core";
-import { acquireLock, releaseLock, checkLock } from "../tx-lock.js";
+} from "@mandujs/core/change";
+import { acquireLock, releaseLock, checkLock, requireLock } from "../tx-lock.js";
 
 export const transactionToolDefinitions: Tool[] = [
   {
@@ -99,9 +99,15 @@ export function transactionTools(projectRoot: string) {
         return { error: lock.error };
       }
 
-      const change = await beginChange(projectRoot, {
-        message: message || "MCP transaction",
-      });
+      let change: Awaited<ReturnType<typeof beginChange>>;
+      try {
+        change = await beginChange(projectRoot, {
+          message: message || "MCP transaction",
+        });
+      } catch (error) {
+        if (lock.lockId) releaseLock(lock.lockId);
+        return { error: error instanceof Error ? error.message : String(error) };
+      }
 
       return {
         success: true,
@@ -122,6 +128,10 @@ export function transactionTools(projectRoot: string) {
           error: "No active transaction to commit",
         };
       }
+      const lockCheck = requireLock(lockId);
+      if (!lockCheck.allowed) {
+        return { error: lockCheck.error };
+      }
 
       const result = await commitChange(projectRoot);
       if (lockId) releaseLock(lockId);
@@ -142,6 +152,10 @@ export function transactionTools(projectRoot: string) {
           error: "No active transaction to rollback. Provide a changeId to rollback a specific change.",
         };
       }
+      const lockCheck = requireLock(lockId);
+      if (!lockCheck.allowed) {
+        return { error: lockCheck.error };
+      }
 
       const result = await rollbackChange(projectRoot, changeId);
       if (lockId) releaseLock(lockId);

package/src/utils/withWarnings.ts

@@ -7,7 +7,7 @@
  * MCP notification이 AI 에이전트에 전달되지 않는 문제를 해결.
  */
 
-import { getWatcher } from "../../../core/src/index.js";
+import { getWatcher } from "@mandujs/core/watcher";
 
 const MUTATION_TOOLS = new Set([
   "mandu_write_slot",